SailPoint IdentityIQ and PM Cloud

This document provides the steps required to configure the integration between SailPoint IdentityIQ and Privilege Management Cloud for Windows and Mac.

Create the IdentityIQ Service Account in PM Cloud

1. Log on to the PM Cloud web console as an Administrator.
2. Go to Configuration, and then API Settings.
3. Create an API account for IdentityIQ.

 

Configure SCIM Application in IdentityIQ for PM Cloud

You must log on to IdentityIQ using administrator credentials.

 

1. Go to Applications, and then Application Definition.
2. Click the Add New Application button.

 

3. From the Application Type menu, select SCIM 2.0. Provide a name for the application.

 

4. On the Configuration tab, provide the base URL and token URL. Select Client Credentials for Grant type. Enter the client Id and secret for the svc_iiq API account.

If the instance URL is https://pmc01.acme.somedomain.net then the API URLs are based on https://pmc01-services.acme.somedomain.com.

 

5. Try testing the connection at this point.

6. Go to the Schema tab.
7. Click Discover Schema Attributes for Object Type: account.
8. The attributes discovered for account are shown.

 

9. Click Provisioning Policies.
10. Click Add Policy, and then click Create Policy Form.

11. Click Add Section, then + on the new Section and Add Field. The first field is userName which maps to email address. Click Apply.

    The script format: return identity.getAttribute("email");

 

12. Set the attribute name.givenName. Click Apply.

 

13. Set the attribute name.familyName. Click Apply.

 

14. Set the attribute email. Click Apply.

 

15. Set the attribute displayName. Click Apply.

 

16. Set the attribute active. Click Apply.

 

17. Set the attribute locale to static, and Value to en-US or en-GB. This can be mapped to an Identity attribute, if available.

 

18. Set the attribute timezone to static value. This can be mapped to an Identity attribute, if available.

 

19. Provide a form name and description, and then save the form. Don’t forget to save the application.
20. Edit the application again, and go to Correlation.
21. Create a correlation rule. Save the application.

22. Create the aggregation task for PM Cloud. Navigate to Setup, then Tasks.
23. Click the New Task menu, then select Account Aggregation.

 

24. Configure the task to scan PM Cloud. Scroll to the bottom of the page and click Save and Execute.
25. Confirm the Task result is Success.

 

26. Go back to the application and select the Accounts tab.

27. Review the discovered or aggregated accounts together with roles.

 

28. Go to Applications, then Entitlement Catalog. Click Add New Entitlement button. The screen capture shows an example for role entitlement.

 

29. The Entitlement Catalog with the requestable roles for PM Cloud.

 

30. Repeat the process for the following roles: Group Viewer, Policy Editor, Policy Viewer, Policy Assigner, Analytics, and Administrator.

Only roles are requestable. Entitlements are read-only in the current RBAC model. This will eventually change.

31. Select a user that does not yet have access to PM Cloud from the menu in the upper left corner. Select Manage Access, and then Manage User Access.

32. Select a test user on the Manage User Access. Click Next.

 

33. Select a role under the PM Cloud Application. Click Next.

 

34. Click Submit.
35. The request should be in Verifying mode.

36. Confirm the new user is added in PM Cloud.

 

37. Go to the Application Accounts tab and view the user application account and roles.